Skip to content

Concept map· 6 connected terms

Cross-Border Data Transfer

Also called: International data transfer · Transfer of personal data outside India · Third-country transfer · Data export

In one line
Moving personal data out of India or the EU: DPDP allows it unless a destination is restricted, GDPR only to adequate countries or with safeguards.

Reviewed

What is cross-border data transfer?

A cross-border data transfer is any movement of personal data that makes it available to a recipient outside the country or region whose law protects it. Copying WhatsApp chat logs from a Pune business to a server in Singapore is one; so is a support team in Chennai opening the records of customers in Germany, or a backup job writing to Frankfurt. Remote access counts as much as a file copy: what matters is where the recipient is.

India's Digital Personal Data Protection Act takes a negative-list approach. Section 16 lets a data fiduciary transfer personal data abroad except to countries or territories the central government restricts by notification, and no country had been notified when this page was reviewed. Section 16(2) keeps any stricter Indian law in force — the Reserve Bank of India's 2018 direction that payment-system data be stored only in India is the familiar example — and rule 15 of the DPDP Rules 2025 lets the government attach requirements on making data available to foreign states. Most of these obligations phase in by 2027.

The EU's General Data Protection Regulation (GDPR) is permissive only by exception. Chapter V allows a transfer outside the EU where the European Commission has found the destination adequate (article 45 — Japan, the UK and South Korea, and US companies certified under the EU–US Data Privacy Framework since July 2023), where appropriate safeguards such as the 2021 standard contractual clauses or binding corporate rules are in place (article 46), or under narrow derogations (article 49). India has no adequacy decision, so data about people in the EU reaches Indian systems on contractual safeguards, backed since the 2020 Schrems II judgment by an assessment of the destination's laws.

WhatsApp traffic crosses borders by design. The Cloud API is hosted by Meta, which processes message content as a data processor and keeps message data for at most 30 days; Cloud API local storage can hold message content at rest in a chosen country such as India, though Meta says content may still be processed in data centres elsewhere. Where data sits is a Data Residency question; whether it may move is this one.

Key takeaways

  • A cross-border data transfer makes personal data available to someone outside the country whose law protects it, including by remote access.
  • India's DPDP Act uses a negative list: transfers are allowed unless the government notifies a destination as restricted (section 16).
  • No country had been notified as restricted when this page was reviewed; stricter sector rules such as the RBI's payment-data storage still apply.
  • Under the GDPR, data leaves the EU only with an adequacy decision, safeguards such as standard contractual clauses, or narrow derogations.
  • The EU has no adequacy decision for India, so EU-to-India transfers usually rest on standard contractual clauses plus a transfer risk assessment.

Give each data flow its legal route

8 / 8

Only agents with the required skill are eligible; the least busy of them wins.

Incoming · 0 left

  1. All 8 conversations have been routed.

Conversation 8 of 8 · Skills-based

EU list → US vendor (DPF)(needs EU → adequate)goes toEU adequacy decision

Skills: needs EU → adequate, and only EU adequacy decision has it.

  • DPDP default: not restricted

    3 of 4 open

    • India → abroad
    1. Chat logs · Pune → Singaporeneeds India → abroad
    2. Backups · Mumbai → Frankfurtneeds India → abroad
    3. Cloud API messages · India → Metaneeds India → abroad

  • EU adequacy decision

    2 of 2 open

    Full
    • EU → adequate
    1. EU leads · Dublin → Tokyoneeds EU → adequate
    2. EU list → US vendor (DPF)needs EU → adequate

  • Standard contractual clauses

    2 of 3 open

    • EU → India
    1. EU bookings · Berlin → Kochi CRMneeds EU → India
    2. Chennai agents open EU chatsneeds EU → India

  • Keep in India (sector rule)

    1 of 2 open

    • payment data
    1. UPI refund recordsneeds payment data

Waiting · 0

  1. Nobody waiting: every conversation found an agent.
Same 8 conversations, each strategy
StrategyRoutedWaitingSkill mismatches
Skills-based800
Round-robin807
Each chip is a real-world data flow from a WhatsApp business. Skills-based routing sends it to the only legal route that fits; switch to round-robin to see how picking a mechanism by turn creates mismatches.

Conversation 8 of 8, EU list → US vendor (DPF): Skills: needs EU → adequate, and only EU adequacy decision has it.

Key facts at a glance

Cross-border data transfer: key facts and limits

India rule
DPDP Act s. 16 — allowed unless destination restricted
Restricted countries notified
None as of 19 October 2026
Stricter Indian laws
Preserved by s. 16(2), e.g. RBI payment-data storage
EU rule
GDPR Chapter V (articles 44–49)
EU adequacy for India
None — SCCs or other safeguards
Current EU SCCs
Adopted by the Commission in June 2021
GDPR fine band for transfers
Up to €20M or 4% of worldwide turnover

Why does cross-border data transfer matter?

Transfer rules decide which vendors you can use and what your contracts must say. An Indian brand messaging EU tourists, a BSP with servers abroad, a CRM in the US and an offshore support desk can each create a transfer that needs a legal route, and a regulated lender may face sector rules that the DPDP Act's default does not relax. Getting it wrong is costly: unlawful transfers fall in the GDPR's top fine band of up to €20 million or 4% of worldwide turnover, and enterprise buyers now ask for a transfer map in every security review.

How does cross-border data transfer work?

  1. Map every flow

    List where WhatsApp data goes: Meta's Cloud API, your BSP's inbox and contact store, CRM, analytics, chatbot and LLM vendors, backups and any team that can open records from another country.

  2. Check India's restrictions first

    For data about people in India, confirm no destination is on a notified restricted list and check sector rules — RBI payment-data storage, and any localisation your regulator imposes — which prevail over the DPDP default.

  3. Pick a GDPR route for EU data

    Use an adequacy decision where the destination has one; otherwise sign standard contractual clauses (or rely on binding corporate rules) and document a transfer risk assessment. Keep derogations for genuinely occasional cases.

  4. Write it into the contract

    Your Data Processing Agreement should list each processor and sub-processor with its location, the transfer mechanism, and the vendor's duty to tell you before moving data somewhere new.

  5. Reduce what crosses

    Keep message content at rest in-country where you can, pseudonymise analytics exports, mask phone numbers in logs, and avoid sending full chat transcripts to tools that only need metadata.

Example: A Kochi tour operator with European guests

A Kochi tour operator receives houseboat bookings from a travel agency in Germany and confirms each stay with the guest over WhatsApp. The agency's handover of guest names, numbers and dates to Kochi is a GDPR transfer to a country without an adequacy decision, so the two firms sign standard contractual clauses and the operator answers the agency's transfer risk questionnaire; the clauses also govern the onward copy into the operator's US-hosted CRM. Bookings from Indian guests go into the same CRM with no special route under the DPDP Act, because no destination is restricted — the team simply records the flow and the vendor's location in its transfer map. Card payments never touch the CRM: they run through an Indian payment gateway that keeps payment data in India, as the RBI requires.

Common wrong turns

Common mistakes with cross-border data transfer

  • Thinking remote access is not a transfer

    An offshore agent viewing EU customers' chats is a transfer even if no file moves. Map access by location of the person, not only of the server.

  • Assuming the DPDP default overrides sector rules

    Section 16 allows most transfers, but stricter laws stay in force. Regulated businesses must check RBI, SEBI or IRDAI requirements before moving data abroad.

  • Signing SCCs and stopping there

    Since Schrems II, standard contractual clauses need an assessment of the destination's laws and, where needed, extra measures such as encryption with keys kept outside it. File the assessment with the contract.

  • Treating local storage as no transfer

    Keeping message content at rest in India narrows the question but does not end it: processing, support access and other vendors can still move data abroad. Record each flow.

Cross-Border Data Transfer FAQs

Can Indian businesses store customer data outside India under the DPDP Act?+
Yes, unless the destination is restricted or a stricter law applies. Section 16 allows transfers except to countries the government notifies, none had been notified when this page was reviewed, and sector rules such as the RBI's payment-data storage requirement still prevail.
Is India an adequate country under the GDPR?+
No. The European Commission has not adopted an adequacy decision for India, so personal data about people in the EU goes to India under safeguards such as standard contractual clauses, usually with a transfer risk assessment.
Does using the WhatsApp Cloud API mean data leaves India?+
Usually, yes. Meta hosts the Cloud API on its own infrastructure and processes messages as a data processor; local storage can keep message content at rest in India, but Meta says content may still be processed abroad, so treat it as a transfer and record it.
What is the difference between data residency and cross-border data transfer?+
Data residency is where data is stored and processed. Cross-border data transfer is the set of legal rules on whether, and how, personal data may move to another country — you need the answer to the first to apply the second.

Good practice

Best practices for cross-border data transfer

  • Keep a one-page transfer map — data, destination, vendor, legal route — and update it when you add a tool.
  • Ask every new vendor for its sub-processor list and hosting locations before you sign.
  • Watch for government notifications under section 16; a newly restricted destination would need a quick migration plan.

See InfiQ pricing

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms